Read the signing certificate from relative paths in macos-verify.sh

The certificate was extracted after a cd into a temp folder, so relative
paths (as the release workflow passes them) were not found and the check
exited without a message. Extract with a path prefix instead.

Author: danielehrhardt

scripts/macos-verify.sh

@@ -39,8 +39,8 @@ signer() {
 certificate() {
   local dir="$WORK/certs-$RANDOM"
   mkdir -p "$dir"
-  (cd "$dir" && codesign -d --extract-certificates "$1" 2>/dev/null)
-  local leaf="$dir/codesign0"
+  codesign -d --extract-certificates="$dir/cert" "$1" 2>/dev/null || true
+  local leaf="$dir/cert0"
   [ -f "$leaf" ] || fail "could not read the signing certificate of $1"
   local until
   until="$(openssl x509 -inform DER -in "$leaf" -noout -enddate | cut -d= -f2)"